[tor-commits] [tor/master] Avoid undefined behaviour in ifreq_to_smartlist

[nickm at torproject.org]

commit c8ce973dc7787b5fcf3fbe4527a45575b2fdf5d6
Author: Sebastian Hahn <sebastian at torproject.org>
Date:   Thu Feb 12 14:56:47 2015 +0100

    Avoid undefined behaviour in ifreq_to_smartlist
    
    This could trigger where _SIZEOF_ADDR_IFREQ() might not return a
    multiple of sizeof(void *). Fixes bug 14875; not in any released version
    of Tor.
---
 src/common/address.c |   18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/src/common/address.c b/src/common/address.c
index 8cdcd84..dbb9275 100644
--- a/src/common/address.c
+++ b/src/common/address.c
@@ -1383,17 +1383,24 @@ get_interface_addresses_win32(int severity)
 #define _SIZEOF_ADDR_IFREQ sizeof
 #endif
 
-/** Convert <b>*ifr</b>, an ifreq structure array of size <b>buflen</b>
+/** Convert <b>*buf</b>, an ifreq structure array of size <b>buflen</b>,
  * into smartlist of <b>tor_addr_t</b> structures.
  */
 STATIC smartlist_t *
-ifreq_to_smartlist(char *ifr, size_t buflen)
+ifreq_to_smartlist(char *buf, size_t buflen)
 {
   smartlist_t *result = smartlist_new();
+  char *end = buf + buflen;
 
-  struct ifreq *r = (struct ifreq *)ifr;
+  /* These acrobatics are due to alignment issues which trigger
+   * undefined behaviour traps on OSX. */
+  struct ifreq *r = tor_malloc(IFREQ_SIZE);
+
+  while (buf < end) {
+    /* Copy up to IFREQ_SIZE bytes into the struct ifreq, but don't overrun
+     * buf. */
+    memcpy(r, buf, end - buf < IFREQ_SIZE ? end - buf : IFREQ_SIZE);
 
-  while ((char *)r < (char *)ifr+buflen) {
     const struct sockaddr *sa = &r->ifr_addr;
     tor_addr_t tmp;
     int valid_sa_family = (sa->sa_family == AF_INET ||
@@ -1404,9 +1411,10 @@ ifreq_to_smartlist(char *ifr, size_t buflen)
     if (valid_sa_family && conversion_success)
       smartlist_add(result, tor_memdup(&tmp, sizeof(tmp)));
 
-    r = (struct ifreq *)((char *)r + _SIZEOF_ADDR_IFREQ(*r));
+    buf += _SIZEOF_ADDR_IFREQ(*r);
   }
 
+  tor_free(r);
   return result;
 }